Iron rule: Treat "no obvious validation seen" as a real risk until evidence proves it is safe.
Workflow
- Step 1: Mark sensitive surfaces ⚠️ REQUIRED
- 1.1 Identify login, sessions, permissions, data writes, file access, external requests, and secrets.
- 1.2 Mark paths involving user identity, tenant boundaries, and high-value data.
- Step 2: Audit by category ⚠️ REQUIRED
- 2.1 Check whether authentication and authorization are complete.
- 2.2 Check whether input handling has injection, XSS, path traversal, or command execution risks.
- 2.3 Check whether logs, configuration, and committed content leak secrets.
- 2.4 Check whether dependencies and default configurations have dangerous default values.
- Step 3: Assess impact
- 3.1 Clarify exploitability, scope of impact, and remediation priority.
- 3.2 When uncertain, explain the points that require manual verification rather than rashly approving.
Anti-patterns
- Only scanning for secrets without auditing permissions and input handling.
- Assuming it is safe just because a helper name looks like requireAuth.
- Treating "local environment" or "internal system" as an acceptable security exemption.
Pre-delivery checklist
- The dimensions of authentication, authorization, input, logs, configuration, and dependencies have been covered.
- Each high-risk point explains the exploitation method or impact.
- Uncertain points have clearly marked manual verification needs.
- No security conclusion has been weakened on the grounds of environment or scale.